filebeat 报错：Failed to publish events

背景：

  使用filebeat 往 logstash中传递数据，查看filebeta日志发现报错。

 

filebeat报错：

  ERROR    logstash/async.go:235    Failed to publish events caused by: write tcp 127.0.0.1:54972->127.0.0.1:5044: write: connection reset by peer

2020-09-18T13:50:19.159+0800	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":780,"time":783},"total":{"ticks":2050,"time":2060,"value":2050},"user":{"ticks":1270,"time":1277}},"info":{"ephemeral_id":"acd7c512-ca96-49b6-b4cc-5b66f5f9f07a","uptime":{"ms":2670015}},"memstats":{"gc_next":7405136,"memory_alloc":3901896,"memory_total":101814928,"rss":2478080}},"filebeat":{"events":{"active":-30,"added":1,"done":31},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":31,"batches":5,"total":31},"read":{"bytes":30},"write":{"bytes":5897}},"pipeline":{"clients":5,"events":{"active":0,"published":1,"retry":15,"total":1},"queue":{"acked":31}}},"registrar":{"states":{"current":286,"update":31},"writes":3},"system":{"load":{"1":0.47,"15":0.11,"5":0.3,"norm":{"1":0.1175,"15":0.0275,"5":0.075}}}}}}
2020-09-18T13:50:42.804+0800	ERROR	logstash/async.go:235	Failed to publish events caused by: write tcp 127.0.0.1:54972->127.0.0.1:5044: write: connection reset by peer
2020-09-18T13:50:43.804+0800	ERROR	pipeline/output.go:92	Failed to publish events: write tcp 127.0.0.1:54972->127.0.0.1:5044: write: connection reset by peer
2020-09-18T13:50:45.805+0800	ERROR	pipeline/output.go:74	Failed to connect: dial tcp 127.0.0.1:5044: getsockopt: connection refused

 

原因：

  据说是客户端操作不频繁导致Logstash可能由于不工作而尝试重置连接，在这种情况下会引起connection reset by peer

 

解决方法：

  在logstash的配置文件添加client_inactivity_timeout参数：

input {
 beats {
	port  => "5044"
	codec => json
    client_inactivity_timeout => 36000
 }
}

 

参考文档：

https://discuss.elastic.co/t/solved-filebeat-logstash-connection-reset-by-peer/87012